Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to open a safe

github.com

Post reply on HN
Print view View original

71–80 of 85 posts

Re: How to open a safe

#71

Post by kube-system »

sgustard wrote: post #65
kube-system wrote: post #46

Earlier quoted context omitted.

These are really just fire safes. They’re made to protect important documents from being destroyed in the amount of time it takes a fire truck to put your house fire out. The lock is mostly to keep kids or guests out. The biggest security vulnerability in these “safes” is not the lock. It’s that a thief can simply pick it up and walk away with it.

Well, many people bolt their safe to their house. That adds some time for the thief to abscond with it. But I don't think "not meant to be secure anyway" is an excuse for "designed with a trivial security flaw." I mean, am I still supposed to trust what the manufacturer says about its fire resistance?

Most small desktop fire safes, like the one in this post, don’t have the provisions to do that unless you modify them.

These safes usually have a rating to be resistant to fire, but they usually lack any burglary-resistance ratings.

Burglary rated safes are expensive. They’re more expensive than the crap most homeowners want to put inside of their safe.

Re: How to open a safe

#72

Post by kube-system »

giantg2 wrote: post #57
kube-system wrote: post #43

Earlier quoted context omitted.

They’re high end consumer-grade safes. Which in the world of commercial-grade security, is also known as “not a safe”. So, depending on your perspective, they’re either really good, or entirely unusable.

I would have thought things like ISM would be top quality consumer grade.

ISM makes TL rated safes. Actual security devices. This is the entry level of what you might need as a business owners.

They’re more expensive than what 99% of homeowners put inside of their safes.

Re: How to open a safe

#73

Post by walterbell »

TedDoesntTalk wrote: post #30
giantg2 wrote: post #25

To be honest, I would go with a manual dial/lock/safe/etc. I don't trust most mass produced electronic physical security stuff (consumer grade or affordable stuff anyways). The non-electronic stuff is still vulnerable, but it's not this fast to attack.

In large, high-end gun safes like Liberty, it is difficult to find them with mechanical locks anymore. They just don't make them.

Some electronic locks can be replaced with a reliable Sargent & Greenleaf mechanical combination lock, if they have standard mounting.

Re: How to open a safe

#74

Post by walls »

stavros wrote: post #69
tgsovlerkhgsel wrote: post #66

Earlier quoted context omitted.

Which doesn't help if you assume the attacker has a dremel.

"Opening it with a dremel" is a completely different class of attacks from "opening it without leaving a trace".

Changing the lock code isn't really leaving without a trace.

Re: How to open a safe

#75

Post by stavros »

walls wrote: post #74
stavros wrote: post #69

Earlier quoted context omitted.

"Opening it with a dremel" is a completely different class of attacks from "opening it without leaving a trace".

Changing the lock code isn't really leaving without a trace.

Is it the same as taking a dremel to it?

Re: How to open a safe

#76

Post by donavanm »

kube-system wrote: post #43
giantg2 wrote: post #35

Earlier quoted context omitted.

Is Liberty really high-end? I would have thought they were mid-grade. I think most places have options for mechanical or electronic. Granted the electronics on those should be considerably better than the ones in the article, at least from a simple access perspective of not pulling the keypad off from the outside.

They’re high end consumer-grade safes. Which in the world of commercial-grade security, is also known as “not a safe”. So, depending on your perspective, they’re either really good, or entirely unusable.

Indeed, theyre almost always "residential security containers" at best. Which means the manufacturer can't even be bothered to assert that it would take 5 minute to break in to with hand tools.

Re: How to open a safe

#77

Post by MiddleEndian »

walls wrote: post #74
stavros wrote: post #69

Earlier quoted context omitted.

"Opening it with a dremel" is a completely different class of attacks from "opening it without leaving a trace".

Changing the lock code isn't really leaving without a trace.

If I open my hypothetical safe once a month, I may not find out that someone has changed the code for up to a month.

If someone cuts it open with a dremel, I'll notice as soon as I happen to see it.

Re: How to open a safe

#78

Post by MiddleEndian »

jeroenhd wrote: post #29
420official wrote: post #26

Earlier quoted context omitted.

Safes like this are more meant to be tamper-evident and hard to move than impervious, which is why you always want to bolt your safe down to something solid if you have one like this. A warrant and a circular saw will get you through really any consumer safe in seconds so I highly doubt they would go through all that risk to make it slightly easier to access but maybe there's concern of damaging evidence with forced…

The nice thing about this is that it's still tamper-evident, despite being opened non-violently. The PIN suddenly changed, so the owner knows that someone messed with their safe. Whether they did so by picking the backup lock or by using technology doesn't matter, the safe was obviously breached. The safe would've lost its purpose entirely if it was possible to open the lock without resetting the PIN. I'm sure there'…

If I open my hypothetical safe once a month, I may not find out that someone has changed the code for up to a month.

If someone cuts it open with a dremel, I'll notice as soon as I happen to see it.

Re: How to open a safe

#79

Post by SLWW »

I love how the fix repo is just a re-implementation of the firmware you should see in one of these safes.

Like you are just doing their job for them at that point.

Re: How to open a safe

#80

Post by rozab »

tgsovlerkhgsel wrote: post #32
olivierduval wrote: post #19

Actually the problem here is that it's possible to reinit the PIN when the safe is still closed... so the trick to open the safe is to reinit the PIN then send the new PIN The second problem is the possibility to open the PINpad from the outside with the safe closed. It seem to me that those two problems could easily be fixed by the manufacturer... and I can't understand that they just didn't do it right upfront

The second one is very hard to avoid. The safe could of course have some form of tamper detection/response, but other than that, you can't put the PIN pad in a safe, so a determined attacker will be able to open it (using tools/force if necessary).

As another commenter explained, the only problem here is that the pin pad is doing any logic at all. It should only be sending key presses to the internal controller safely inside the safe body, there is no reason for it to do anything else
Post reply on HN